An information security officer reviews a report and notices a steady increase in outbound network traffic over the past ten months. There is no clear explanation for the increase. The security…

A Network Intrusion Detection System (NIDS) monitors traffic for known attack signatures but does not provide governance or visibility specifically over which cloud services employees are accessing.

A Host Intrusion Prevention System (HIPS) monitors activity on individual endpoints but cannot identify or enforce policies against unsanctioned cloud service usage across the organization.

A CASB acts as an intermediary between users and cloud service providers, giving the security team full visibility into all cloud services in use - including unsanctioned ones discovered through shadow IT. It can enforce policies to block, monitor, or control unauthorized cloud storage providers, preventing data leakage and compliance violations caused by employees using unapproved services.

SFTP is a secure file transfer protocol that could serve as a sanctioned alternative, but it does not detect, govern, or restrict the use of unauthorized third-party cloud storage services.